linux-kernel - Re: [PATCH bpf-next] bpf/helpers: bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_8E830DF8843CB38A2F4354FC5E3146651009@qq.com>
Date: Thu, 28 Aug 2025 10:56:20 +0800
From: Rong Tao <rtoax@...mail.com>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>,
 Viktor Malik <vmalik@...hat.com>
Cc: ast@...nel.org, daniel@...earbox.net, rongtao@...tc.cn,
 Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>,
 Song Liu <song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>,
 "open list:BPF [GENERAL] (Safe Dynamic Programs and Tools)"
 <bpf@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf/helpers: bpf_strnstr: Exact match length


On 8/28/25 06:35, Andrii Nakryiko wrote:
> cc'ing Viktor as well
>
> On Tue, Aug 26, 2025 at 9:29 PM Rong Tao <rtoax@...mail.com> wrote:
>> From: Rong Tao <rongtao@...tc.cn>
>>
>> strnstr should not treat the ending '\0' of s2 as a matching character,
>> otherwise the parameter 'len' will be meaningless, for example:
>>
>>      1. bpf_strnstr("openat", "open", 4) = -ENOENT
>>      2. bpf_strnstr("openat", "open", 5) = 0
> please add these cases to the tests
>
>> This patch makes (1) return 0, indicating a successful match.
>>
>> Signed-off-by: Rong Tao <rongtao@...tc.cn>
>> ---
>>   kernel/bpf/helpers.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
>> index 401b4932cc49..65bd0050c560 100644
>> --- a/kernel/bpf/helpers.c
>> +++ b/kernel/bpf/helpers.c
>> @@ -3681,6 +3681,8 @@ __bpf_kfunc int bpf_strnstr(const char *s1__ign, const char *s2__ign, size_t len
>>                                  return -ENOENT;
>>                          if (c1 != c2)
>>                                  break;
>> +                       if (j == len - 1)
>> +                               return i;
> But this seems like a wrong fix. The API assumes that s2 is
Thanks a lot Andrii Nakryiko, I just submit V2, please review.
> well-formed zero-terminated string, and so we shouldn't just randomly
> truncate it. Along the examples above, what will happen to
> bpf_strnstr("openat", "open", 3)? With your fix it will return
> success, right? But it shouldn't, IMO, because "open" wasn't really
> found in the first 3 characters of, effectively, "ope".
>
> We should also test bpf_strnstr("", "", 0)... ;)
>
>
> So maybe something like this (but I haven't really tested it):
>
>
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 401b4932cc49..ced7132980fe 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3672,10 +3672,12 @@ __bpf_kfunc int bpf_strnstr(const char
> *s1__ign, const char *s2__ign, size_t len
>
>          guard(pagefault)();
>          for (i = 0; i < XATTR_SIZE_MAX; i++) {
> -               for (j = 0; i + j < len && j < XATTR_SIZE_MAX; j++) {
> +               for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) {
>                          __get_kernel_nofault(&c2, s2__ign + j, char, err_out);
>                          if (c2 == '\0')
>                                  return i;
> +                       if (i + j == len)
> +                               break;
It's works fine, thanks.
>                          __get_kernel_nofault(&c1, s1__ign + j, char, err_out);
>                          if (c1 == '\0')
>                                  return -ENOENT;
>
>
> pw-bot: cr
>
>
>>                  }
>>                  if (j == XATTR_SIZE_MAX)
>>                          return -E2BIG;
>> --
>> 2.51.0
>>
>>